{"id":"CVE-2023-48268","state":"PUBLISHED","title":"Denial of Service via Board Import Zip Bomb","description":"Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).\n\n","publishedAt":"2023-11-27T09:07:29.918Z","updatedAt":"2024-12-02T19:33:50.978Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.8.12","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"8.1.3","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"9.0.1","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"9.1.0","versionType":"semver"},{"version":"9.1.1","status":"unaffected"},{"version":"9.0.2","status":"unaffected"},{"version":"7.8.13","status":"unaffected"},{"version":"8.1.4","status":"unaffected"}]}],"references":["https://mattermost.com/security-updates"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/48xxx/CVE-2023-48268.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-48268","state":"PUBLISHED","datePublished":"2023-11-27T09:07:29.918Z","dateUpdated":"2024-12-02T19:33:50.978Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2023-11-22T11:18:57.625Z"},"containers":{"cna":{"title":"Denial of Service via Board Import Zip Bomb","descriptions":[{"lang":"en","value":"Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).\n\n"}],"affected":[{"vendor":"Mattermost","product":"Mattermost","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.8.12","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"8.1.3","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"9.0.1","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"9.1.0","versionType":"semver"},{"version":"9.1.1","status":"unaffected"},{"version":"9.0.2","status":"unaffected"},{"version":"7.8.13","status":"unaffected"},{"version":"8.1.4","status":"unaffected"}]}],"references":[{"url":"https://mattermost.com/security-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateUpdated":"2023-11-27T09:07:29.918Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"vultza (vultza)"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Update Mattermost Server to versions 9.1.1, 9.0.2, 7.8.13, 8.1.4 or higher.</p>"}],"value":"Update Mattermost Server to versions 9.1.1, 9.0.2, 7.8.13, 8.1.4 or higher.\n\n"}],"source":{"advisory":"MMSA-2023-00218","defect":["https://mattermost.atlassian.net/browse/MM-53231"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T21:23:39.504Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-02T19:33:03.704927Z","id":"CVE-2023-48268","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-02T19:33:50.978Z"}}]}}}